Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

CrowdStrike Exam CCFR-201 Topic 2 Question 22 Discussion

Actual exam question for CrowdStrike's CCFR-201 exam
Question #: 22
Topic #: 2
[All CCFR-201 Questions]

From a detection, what is the fastest way to see children and sibling process information?

Show Suggested Answer Hide Answer
Suggested Answer: B

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Global Prevalence and Local Prevalence are two fields that provide information about how common or rare a file is based on its hash value2.Global Prevalence tells you how frequently the hash of the triggering file is seen across all CrowdStrike customer environments2.Local Prevalence tells you how frequently the hash of the triggering file is seen within your environment (CID)2.These fields can help you assess the risk and impact of a detection2.


by King at Sep 08, 2024, 09:32 AM

Limited Time Offer

25%

Off

Get Premium CCFR-201 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel
Loise
5 days ago
Hmm, I'm not sure. The Process Timeline feature sounds interesting, but I'm worried it might be a bit too complicated for a quick lookup. I'll have to think this one through.
upvoted 0 times
...
Merilyn
7 days ago
I prefer to use the Process Timeline feature and enter the IDs. It gives a more detailed view of the process chain.
upvoted 0 times
...
Jutta
7 days ago
I think the fastest way is to select the Event Search option and then choose Show Associated Event Data (From TargetProcessld_decimal). It seems like the most direct approach to get the child and sibling process info.
upvoted 0 times
...
Shenika
10 days ago
I agree with Carole, that seems like the most efficient way to see children and sibling process information.
upvoted 0 times
...
Carole
16 days ago
I think the fastest way is to select the Event Search option and then Show Associated Event Data.
upvoted 0 times
...

Save Cancel